Security Magic

PureRAT analysis, PYC disassembly, shellcode, and Reactor .NET binaries extracted. IOCs and Detection. Executive Summary I analyzed a malware chain beginning with DriveVideoSetup-x64-0.1.0.exe , distributed through a fake Drive Video /SMVEO-themed lure. The malware uses a staged execution chain that moves from Python bytecode into shellcode, then into multiple protected .NET assemblies. The chain includes heavy obfuscation and encryption, runtime patching ,certificate generation, protobuf references, and authenticated WebSocket communications. Dynamic analysis observed the malware enrolling with infrastructure, creating certificate material under %LOCALAPPDATA%\SMVEO\ , connecting to agent.sm-veo.com , and logging agent starting 2.3.0 , auto-enrolling , and ws connection . Multiple indicators suggest this activity is DonutLoader leading to PureRAT . Execution Workflow DriveVideoSetup-x64-0.1.0.exe ↓ Persistence via CurrentVersion\Run ↓ python.pyc ↓ Base85 decode ↓ zlib de...

 Hello World! I've been looking at some PYC samples lately, and decided to do a deep dive into the sample on this x post :  https://x.com/malmoeb/status/1853723915723350526 Specifically, I'm looking at  sample SHA256: de195ebb0f1cf3762d73f956b9d21b63de1a5bbe9626a78af623ed9f59ed760f The first thing I did when looking at this sample was run pycdas : We get a look at the disassembled code here.  The first few bytes ""\xfd7zXZ"" suggest LZMA XZ Compressed. Using the following simple script you can output this to a file  I ran an output to decodedfile.txt here. Analyzing this file we can see variables with names like "___", "_____" etc.... We can see some of the decode logic, such as charcode 98, 54, 52, 100, 101, 99, 111, 100, 101 for b64decode, b64decode("cm90MTM=") for ROT13, and [::-1] for string reverse. We also cans see that it concatenates the decoded variables together to one final output. Using this guide as a guide, we can...